Environments and base URLs
Where the API lives, what sandbox means at NexG today, and how a connection moves from sandbox to live.
On this page
Base URLs
| What | URL | Notes |
|---|---|---|
| The API | https://api.nexgapp.com/v1 | Every endpoint in the reference. |
| Callbacks to NexG | https://nexgapp.com/api/… | Where partners send signed events, such as the bank webhook. |
| Local development | http://localhost:3002 | For people working on NexG itself: pnpm --filter @nexg/api dev. |
Use HTTPS for every call. Do not let your HTTP client follow a redirect to another host with your key attached.
Sandbox and live today
What sandbox means depends on what you are connecting. Here is where each part of NexG stands.
| Part | Sandbox | Live |
|---|---|---|
| The NexG API | Coming soon: sandbox keys with test data, alongside the first write endpoints. | api.nexgapp.com. Every endpoint on it only reads today, so building against it changes nothing. |
| Bank collections | The NexG Sandbox Bank, on NexG’s test deployments. No real money moves. | Not connected yet. The sandbox bank is refused on the production site. |
| Your systems (POS, ERP, booking, inventory) | A sandbox connection NexG registers and tests, which may be plain http. | A separate live connection: https on a public host, with live credentials. |
Why the API has no sandbox yet
Sandboxes exist so a test cannot do something real. Every endpoint on api.nexgapp.com is a read, so there is nothing for a test to do by accident. A sandbox arrives with the first writes, such as booking a service.
From sandbox to live
Banks and partner systems that NexG calls are connected twice: once in sandbox, once in live. NexG registers each connection in its admin console, under Settings, API & Webhooks.
Share your sandbox details
Give NexG your sandbox base URL, a path it can call to check the connection (such as
/health), and how it should authenticate: a bearer token, an API key header, or basic authentication. Credentials go into NexG's vault through the console. Never send them by email or chat.NexG tests the connection
The test runs from NexG's database, so your credentials are used there and never shown to a browser or a person. The connection is marked connected or failing, with the status code and the time it took.
Test the whole flow
Run real scenarios end to end in sandbox: for a bank, every outcome the Sandbox Bank can produce, and every webhook retry.
Go live
NexG registers the live connection with your live URL and credentials. A live URL must use https and a public host; a local or private address is refused. Bank connections go live only after NexG finance approves limits and reconciliation.
Keys and environments
- An API key from the developer console works against
https://api.nexgapp.com. Keys do not carry an environment today. - Credentials for a connection NexG calls are separate for sandbox and live. A sandbox secret must never be reused in live.
- A shared webhook secret is generated where the sender runs, at least 32 characters long, and stored by NexG in its vault. It is never sent by email or chat.